Give git user its own home, separate from /srv/git

authorized_keys lived under /srv/git (git's $HOME), the same tree
restic backs up and restores. backup couldn't even read it (0700,
unreadable by the backup user), and restore --delete treated it as
extraneous and deleted it, breaking push access after every restore.

git now gets a normal separate home; clone-prefix in cgitrc serves the
repos dir by absolute path instead of the ~-relative form, since that
relied on $HOME being the repos dir. Drops the sshd_config.d Include/
Match-block/AllowUsers approach tried first — it directly conflicted
with pve-lxc-ssh's sshd_config push, which fully overwrites the file
on every run and has no way to know about cgit's edits.

Co-Authored-By: Claude.ai

6 files changed, 1 insertions, 42 deletions

diff --git a/roles/cgit/defaults/main.yml b/roles/cgit/defaults/main.yml
index 90c3d122..6c5ac0bd 100644
--- a/roles/cgit/defaults/main.yml
+++ b/roles/cgit/defaults/main.yml
@@ -4,5 +4,4 @@ cgit_port: 3000
 cgit_repos_dir: "/srv/git"
 cgit_title: "git"
 cgit_description: "personal git repositories"
-cgit_clone_prefix: "ssh://{{ cgit_ssh_user }}@{{ cgit_hostname }}:{{ ssh_port }}/~"
 cgit_ssh_user: "git"
diff --git a/roles/cgit/handlers/main.yml b/roles/cgit/handlers/main.yml
index 259ae0ea..516733f7 100644
--- a/roles/cgit/handlers/main.yml
+++ b/roles/cgit/handlers/main.yml
@@ -4,9 +4,3 @@
   ansible.builtin.service:
     name: lighttpd
     state: restarted
-
-- name: "Restart sshd"
-  become: true
-  ansible.builtin.service:
-    name: sshd
-    state: restarted
diff --git a/roles/cgit/meta/argument_specs.yml b/roles/cgit/meta/argument_specs.yml
index 3e80987e..08f732f6 100644
--- a/roles/cgit/meta/argument_specs.yml
+++ b/roles/cgit/meta/argument_specs.yml
@@ -22,14 +22,6 @@ argument_specs:
         type: "str"
         description: "cgit index page description"
         default: "personal git repositories"
-      cgit_clone_prefix:
-        type: "str"
-        description: >-
-          Clone URL prefix shown in cgit UI. Uses /~ (home-relative, resolves
-          against cgit_ssh_user's home / cgit_repos_dir) instead of the literal
-          cgit_repos_dir path, so the server's filesystem layout isn't exposed
-          in URLs shown to anyone browsing the web UI
-        default: "ssh://{{ cgit_ssh_user }}@{{ cgit_hostname }}:{{ ssh_port }}/~"
       cgit_ssh_user:
         type: "str"
         description: "System user for SSH git push access"
diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml
index 16a9ab61..93b7e4e9 100644
--- a/roles/cgit/tasks/main.yml
+++ b/roles/cgit/tasks/main.yml
@@ -20,7 +20,6 @@
     name: "{{ cgit_ssh_user }}"
     group: "{{ cgit_ssh_user }}"
     shell: "/usr/bin/git-shell"
-    home: "{{ cgit_repos_dir }}"
     create_home: true
     system: true
     password: "*"
@@ -32,38 +31,14 @@
     scope: system
     value: main
 
-- name: "Ensure sshd_config restricts login to expected users"
-  become: true
-  ansible.builtin.lineinfile:
-    path: "/etc/ssh/sshd_config"
-    regexp: "^AllowUsers "
-    line: "AllowUsers root {{ cgit_ssh_user }}"
-    validate: "sshd -T -f %s"
-  notify: "Restart sshd"
-
 - name: "Deploy authorized_keys"
   become: true
   ansible.posix.authorized_key:
     user: "{{ cgit_ssh_user }}"
     key: "{{ item }}"
-    path: "/etc/ssh/authorized_keys/{{ cgit_ssh_user }}"
     state: present
   loop: "{{ user_public_keys }}"
 
-- name: "Configure sshd AuthorizedKeysFile for {{ cgit_ssh_user }}"
-  become: true
-  ansible.builtin.blockinfile:
-    path: "/etc/ssh/sshd_config"
-    marker: "# {mark} ANSIBLE {{ cgit_ssh_user }} MATCH BLOCK"
-    validate: "sshd -T -f %s"
-    block: |
-      Match User {{ cgit_ssh_user }}
-          AuthorizedKeysFile /etc/ssh/authorized_keys/%u
-          AllowTcpForwarding no
-          AllowAgentForwarding no
-          PermitTTY no
-  notify: "Restart sshd"
-
 - name: "Create repos directory"
   become: true
   ansible.builtin.file:
diff --git a/roles/cgit/templates/cgitrc.j2 b/roles/cgit/templates/cgitrc.j2
index 17e95138..299ad66c 100644
--- a/roles/cgit/templates/cgitrc.j2
+++ b/roles/cgit/templates/cgitrc.j2
@@ -8,7 +8,7 @@ repo.group=personal
 root-title={{ cgit_title }}
 root-desc={{ cgit_description }}
 
-clone-prefix={{ cgit_clone_prefix }}
+clone-prefix=ssh://{{ cgit_ssh_user }}@{{ cgit_hostname }}:{{ pve_lxc_ssh_port }}{{ cgit_repos_dir }}
 
 enable-index-links=1
 enable-index-owner=0
diff --git a/roles/pve-lxc-ssh/templates/sshd_config.j2 b/roles/pve-lxc-ssh/templates/sshd_config.j2
index 155eabef..977600ef 100644
--- a/roles/pve-lxc-ssh/templates/sshd_config.j2
+++ b/roles/pve-lxc-ssh/templates/sshd_config.j2
@@ -9,7 +9,6 @@ UsePAM no
 X11Forwarding no
 StreamLocalBindUnlink yes
 PrintMotd yes
-AllowUsers root
 AuthorizedKeysFile .ssh/authorized_keys
 HostKey /etc/ssh/ssh_host_ed25519_key
 Subsystem sftp /usr/lib/ssh/sftp-server